Index: nfs/nfs_nfssvc.c
===================================================================
--- nfs/nfs_nfssvc.c	(revision 195102)
+++ nfs/nfs_nfssvc.c	(working copy)
@@ -79,7 +79,7 @@
 
 	KASSERT(!mtx_owned(&Giant), ("nfssvc(): called with Giant"));
 
-	AUDIT_ARG(cmd, uap->flag);
+	AUDIT_ARG_CMD(uap->flag);
 
 	error = priv_check(td, PRIV_NFS_DAEMON);
 	if (error)
Index: kern/vfs_syscalls.c
===================================================================
--- kern/vfs_syscalls.c	(revision 195102)
+++ kern/vfs_syscalls.c	(working copy)
@@ -189,8 +189,8 @@
 	int error;
 	struct nameidata nd;
 
-	AUDIT_ARG(cmd, uap->cmd);
-	AUDIT_ARG(uid, uap->uid);
+	AUDIT_ARG_CMD(uap->cmd);
+	AUDIT_ARG_UID(uap->uid);
 	if (!prison_allow(td->td_ucred, PR_ALLOW_QUOTAS))
 		return (EPERM);
 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | MPSAFE | AUDITVNODE1,
@@ -371,7 +371,7 @@
 	struct vnode *vp;
 	int error;
 
-	AUDIT_ARG(fd, fd);
+	AUDIT_ARG_FD(fd);
 	error = getvnode(td->td_proc->p_fd, fd, &fp);
 	if (error)
 		return (error);
@@ -379,7 +379,7 @@
 	vfslocked = VFS_LOCK_GIANT(vp->v_mount);
 	vn_lock(vp, LK_SHARED | LK_RETRY);
 #ifdef AUDIT
-	AUDIT_ARG(vnode, vp, ARG_VNODE1);
+	AUDIT_ARG_VNODE(vp, ARG_VNODE1);
 #endif
 	mp = vp->v_mount;
 	if (mp)
@@ -744,7 +744,7 @@
 	int vfslocked;
 	int error;
 
-	AUDIT_ARG(fd, uap->fd);
+	AUDIT_ARG_FD(uap->fd);
 	if ((error = getvnode(fdp, uap->fd, &fp)) != 0)
 		return (error);
 	vp = fp->f_vnode;
@@ -752,7 +752,7 @@
 	fdrop(fp, td);
 	vfslocked = VFS_LOCK_GIANT(vp->v_mount);
 	vn_lock(vp, LK_SHARED | LK_RETRY);
-	AUDIT_ARG(vnode, vp, ARG_VNODE1);
+	AUDIT_ARG_VNODE(vp, ARG_VNODE1);
 	error = change_dir(vp, td);
 	while (!error && (mp = vp->v_mountedhere) != NULL) {
 		int tvfslocked;
@@ -1055,8 +1055,8 @@
 	struct nameidata nd;
 	int vfslocked;
 
-	AUDIT_ARG(fflags, flags);
-	AUDIT_ARG(mode, mode);
+	AUDIT_ARG_FFLAGS(flags);
+	AUDIT_ARG_MODE(mode);
 	/* XXX: audit dirfd */
 	/*
 	 * Only one of the O_EXEC, O_RDONLY, O_WRONLY and O_RDWR may
@@ -1265,8 +1265,8 @@
 	struct nameidata nd;
 	int vfslocked;
 
-	AUDIT_ARG(mode, mode);
-	AUDIT_ARG(dev, dev);
+	AUDIT_ARG_MODE(mode);
+	AUDIT_ARG_DEV(dev);
 	switch (mode & S_IFMT) {
 	case S_IFCHR:
 	case S_IFBLK:
@@ -1414,7 +1414,7 @@
 	struct nameidata nd;
 	int vfslocked;
 
-	AUDIT_ARG(mode, mode);
+	AUDIT_ARG_MODE(mode);
 restart:
 	bwillwrite();
 	NDINIT_AT(&nd, CREATE, LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1,
@@ -1677,7 +1677,7 @@
 		if ((error = copyinstr(path1, syspath, MAXPATHLEN, NULL)) != 0)
 			goto out;
 	}
-	AUDIT_ARG(text, syspath);
+	AUDIT_ARG_TEXT(syspath);
 restart:
 	bwillwrite();
 	NDINIT_AT(&nd, CREATE, LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1,
@@ -2689,7 +2689,7 @@
 	struct nameidata nd;
 	int vfslocked;
 
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FFLAGS(uap->flags);
 	NDINIT(&nd, LOOKUP, FOLLOW | MPSAFE | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
 	if ((error = namei(&nd)) != 0)
@@ -2717,7 +2717,7 @@
 	struct nameidata nd;
 	int vfslocked;
 
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FFLAGS(uap->flags);
 	NDINIT(&nd, LOOKUP, NOFOLLOW | MPSAFE | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
 	if ((error = namei(&nd)) != 0)
@@ -2751,14 +2751,14 @@
 	int vfslocked;
 	int error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_FFLAGS(uap->flags);
 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0)
 		return (error);
 	vfslocked = VFS_LOCK_GIANT(fp->f_vnode->v_mount);
 #ifdef AUDIT
 	vn_lock(fp->f_vnode, LK_SHARED | LK_RETRY);
-	AUDIT_ARG(vnode, fp->f_vnode, ARG_VNODE1);
+	AUDIT_ARG_VNODE(fp->f_vnode, ARG_VNODE1);
 	VOP_UNLOCK(fp->f_vnode, 0);
 #endif
 	error = setfflags(td, fp->f_vnode, uap->flags);
@@ -2877,7 +2877,7 @@
 	int vfslocked;
 	int follow;
 
-	AUDIT_ARG(mode, mode);
+	AUDIT_ARG_MODE(mode);
 	follow = (flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW : FOLLOW;
 	NDINIT_AT(&nd, LOOKUP,  follow | MPSAFE | AUDITVNODE1, pathseg, path,
 	    fd, td);
@@ -2912,14 +2912,14 @@
 	int vfslocked;
 	int error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(mode, uap->mode);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_MODE(uap->mode);
 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0)
 		return (error);
 	vfslocked = VFS_LOCK_GIANT(fp->f_vnode->v_mount);
 #ifdef AUDIT
 	vn_lock(fp->f_vnode, LK_SHARED | LK_RETRY);
-	AUDIT_ARG(vnode, fp->f_vnode, ARG_VNODE1);
+	AUDIT_ARG_VNODE(fp->f_vnode, ARG_VNODE1);
 	VOP_UNLOCK(fp->f_vnode, 0);
 #endif
 	error = setfmode(td, fp->f_vnode, uap->mode);
@@ -3019,7 +3019,7 @@
 	struct nameidata nd;
 	int error, vfslocked, follow;
 
-	AUDIT_ARG(owner, uid, gid);
+	AUDIT_ARG_OWNER(uid, gid);
 	follow = (flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW : FOLLOW;
 	NDINIT_AT(&nd, LOOKUP, follow | MPSAFE | AUDITVNODE1, pathseg, path,
 	    fd, td);
@@ -3089,14 +3089,14 @@
 	int vfslocked;
 	int error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(owner, uap->uid, uap->gid);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_OWNER(uap->uid, uap->gid);
 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0)
 		return (error);
 	vfslocked = VFS_LOCK_GIANT(fp->f_vnode->v_mount);
 #ifdef AUDIT
 	vn_lock(fp->f_vnode, LK_SHARED | LK_RETRY);
-	AUDIT_ARG(vnode, fp->f_vnode, ARG_VNODE1);
+	AUDIT_ARG_VNODE(fp->f_vnode, ARG_VNODE1);
 	VOP_UNLOCK(fp->f_vnode, 0);
 #endif
 	error = setfown(td, fp->f_vnode, uap->uid, uap->gid);
@@ -3324,7 +3324,7 @@
 	int vfslocked;
 	int error;
 
-	AUDIT_ARG(fd, fd);
+	AUDIT_ARG_FD(fd);
 	if ((error = getutimes(tptr, tptrseg, ts)) != 0)
 		return (error);
 	if ((error = getvnode(td->td_proc->p_fd, fd, &fp)) != 0)
@@ -3332,7 +3332,7 @@
 	vfslocked = VFS_LOCK_GIANT(fp->f_vnode->v_mount);
 #ifdef AUDIT
 	vn_lock(fp->f_vnode, LK_SHARED | LK_RETRY);
-	AUDIT_ARG(vnode, fp->f_vnode, ARG_VNODE1);
+	AUDIT_ARG_VNODE(fp->f_vnode, ARG_VNODE1);
 	VOP_UNLOCK(fp->f_vnode, 0);
 #endif
 	error = setutimes(td, fp->f_vnode, ts, 2, tptr == NULL);
@@ -3478,7 +3478,7 @@
 	int vfslocked;
 	int error, lock_flags;
 
-	AUDIT_ARG(fd, uap->fd);
+	AUDIT_ARG_FD(uap->fd);
 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0)
 		return (error);
 	vp = fp->f_vnode;
@@ -3492,7 +3492,7 @@
 		lock_flags = LK_EXCLUSIVE;
 	}
 	vn_lock(vp, lock_flags | LK_RETRY);
-	AUDIT_ARG(vnode, vp, ARG_VNODE1);
+	AUDIT_ARG_VNODE(vp, ARG_VNODE1);
 	if (vp->v_object != NULL) {
 		VM_OBJECT_LOCK(vp->v_object);
 		vm_object_page_clean(vp->v_object, 0, 0, 0);
@@ -3717,7 +3717,7 @@
 	struct nameidata nd;
 	int vfslocked;
 
-	AUDIT_ARG(mode, mode);
+	AUDIT_ARG_MODE(mode);
 restart:
 	bwillwrite();
 	NDINIT_AT(&nd, CREATE, LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1,
@@ -4056,7 +4056,7 @@
 	long loff;
 	int error, eofflag;
 
-	AUDIT_ARG(fd, fd);
+	AUDIT_ARG_FD(fd);
 	if (count > INT_MAX)
 		return (EINVAL);
 	if ((error = getvnode(td->td_proc->p_fd, fd, &fp)) != 0)
@@ -4082,7 +4082,7 @@
 	auio.uio_td = td;
 	auio.uio_resid = count;
 	vn_lock(vp, LK_SHARED | LK_RETRY);
-	AUDIT_ARG(vnode, vp, ARG_VNODE1);
+	AUDIT_ARG_VNODE(vp, ARG_VNODE1);
 	loff = auio.uio_offset = fp->f_offset;
 #ifdef MAC
 	error = mac_vnode_check_readdir(td->td_ucred, vp);
Index: kern/kern_thr.c
===================================================================
--- kern/kern_thr.c	(revision 195102)
+++ kern/kern_thr.c	(working copy)
@@ -350,7 +350,7 @@
 	struct proc *p;
 	int error;
 
-	AUDIT_ARG(signum, uap->sig);
+	AUDIT_ARG_SIGNUM(uap->sig);
 
 	if (uap->pid == td->td_proc->p_pid) {
 		p = td->td_proc;
@@ -358,7 +358,7 @@
 	} else if ((p = pfind(uap->pid)) == NULL) {
 		return (ESRCH);
 	}
-	AUDIT_ARG(process, p);
+	AUDIT_ARG_PROCESS(p);
 
 	error = p_cansignal(td, p, uap->sig);
 	if (error == 0) {
Index: kern/vfs_lookup.c
===================================================================
--- kern/vfs_lookup.c	(revision 195102)
+++ kern/vfs_lookup.c	(working copy)
@@ -164,9 +164,9 @@
 
 	/* If we are auditing the kernel pathname, save the user pathname. */
 	if (cnp->cn_flags & AUDITVNODE1)
-		AUDIT_ARG(upath, td, cnp->cn_pnbuf, ARG_UPATH1);
+		AUDIT_ARG_UPATH(td, cnp->cn_pnbuf, ARG_UPATH1);
 	if (cnp->cn_flags & AUDITVNODE2)
-		AUDIT_ARG(upath, td, cnp->cn_pnbuf, ARG_UPATH2);
+		AUDIT_ARG_UPATH(td, cnp->cn_pnbuf, ARG_UPATH2);
 
 	/*
 	 * Don't allow empty pathnames.
@@ -460,9 +460,6 @@
 	int dvfslocked;			/* VFS Giant state for parent */
 	int tvfslocked;
 	int lkflags_save;
-#ifdef AUDIT
-	struct thread *td = curthread;
-#endif
 	
 	/*
 	 * Setup: break out flag bits into variables.
@@ -572,9 +569,9 @@
 		ndp->ni_vp = dp;
 
 		if (cnp->cn_flags & AUDITVNODE1)
-			AUDIT_ARG(vnode, dp, ARG_VNODE1);
+			AUDIT_ARG_VNODE(dp, ARG_VNODE1);
 		else if (cnp->cn_flags & AUDITVNODE2)
-			AUDIT_ARG(vnode, dp, ARG_VNODE2);
+			AUDIT_ARG_VNODE(dp, ARG_VNODE2);
 
 		if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF)))
 			VOP_UNLOCK(dp, 0);
@@ -857,9 +854,9 @@
 		VOP_UNLOCK(ndp->ni_dvp, 0);
 
 	if (cnp->cn_flags & AUDITVNODE1)
-		AUDIT_ARG(vnode, dp, ARG_VNODE1);
+		AUDIT_ARG_VNODE(dp, ARG_VNODE1);
 	else if (cnp->cn_flags & AUDITVNODE2)
-		AUDIT_ARG(vnode, dp, ARG_VNODE2);
+		AUDIT_ARG_VNODE(dp, ARG_VNODE2);
 
 	if ((cnp->cn_flags & LOCKLEAF) == 0)
 		VOP_UNLOCK(dp, 0);
Index: kern/kern_sig.c
===================================================================
--- kern/kern_sig.c	(revision 195102)
+++ kern/kern_sig.c	(working copy)
@@ -1674,8 +1674,8 @@
 	register struct proc *p;
 	int error;
 
-	AUDIT_ARG(signum, uap->signum);
-	AUDIT_ARG(pid, uap->pid);
+	AUDIT_ARG_SIGNUM(uap->signum);
+	AUDIT_ARG_PID(uap->pid);
 	if ((u_int)uap->signum > _SIG_MAXSIG)
 		return (EINVAL);
 
@@ -1685,7 +1685,7 @@
 			if ((p = zpfind(uap->pid)) == NULL)
 				return (ESRCH);
 		}
-		AUDIT_ARG(process, p);
+		AUDIT_ARG_PROCESS(p);
 		error = p_cansignal(td, p, uap->signum);
 		if (error == 0 && uap->signum)
 			psignal(p, uap->signum);
@@ -1717,8 +1717,8 @@
 	register struct okillpg_args *uap;
 {
 
-	AUDIT_ARG(signum, uap->signum);
-	AUDIT_ARG(pid, uap->pgid);
+	AUDIT_ARG_SIGNUM(uap->signum);
+	AUDIT_ARG_PID(uap->pgid);
 	if ((u_int)uap->signum > _SIG_MAXSIG)
 		return (EINVAL);
 
Index: kern/vfs_mount.c
===================================================================
--- kern/vfs_mount.c	(revision 195102)
+++ kern/vfs_mount.c	(working copy)
@@ -388,7 +388,7 @@
 	int error;
 	u_int iovcnt;
 
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FFLAGS(uap->flags);
 	CTR4(KTR_VFS, "%s: iovp %p with iovcnt %d and flags %d", __func__,
 	    uap->iovp, uap->iovcnt, uap->flags);
 
@@ -750,7 +750,7 @@
 	struct mntarg *ma = NULL;
 	int error;
 
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FFLAGS(uap->flags);
 
 	/*
 	 * Filter out MNT_ROOTFS.  We do not want clients of mount() in
@@ -767,7 +767,7 @@
 		return (error);
 	}
 
-	AUDIT_ARG(text, fstype);
+	AUDIT_ARG_TEXT(fstype);
 	mtx_lock(&Giant);
 	vfsp = vfs_byname_kld(fstype, td, &error);
 	free(fstype, M_TEMP);
@@ -1125,7 +1125,7 @@
 		free(pathbuf, M_TEMP);
 		return (error);
 	}
-	AUDIT_ARG(upath, td, pathbuf, ARG_UPATH1);
+	AUDIT_ARG_UPATH(td, pathbuf, ARG_UPATH1);
 	mtx_lock(&Giant);
 	if (uap->flags & MNT_BYFSID) {
 		/* Decode the filesystem ID. */
Index: kern/kern_exit.c
===================================================================
--- kern/kern_exit.c	(revision 195102)
+++ kern/kern_exit.c	(working copy)
@@ -211,7 +211,7 @@
 	 * it was.  The exit status is WEXITSTATUS(rv), but it's not clear
 	 * what the return value is.
 	 */
-	AUDIT_ARG(exit, WEXITSTATUS(rv), 0);
+	AUDIT_ARG_EXIT(WEXITSTATUS(rv), 0);
 	AUDIT_SYSCALL_EXIT(0, td);
 #endif
 
@@ -803,7 +803,7 @@
 	struct proc *p, *q;
 	int error, nfound;
 
-	AUDIT_ARG(pid, pid);
+	AUDIT_ARG_PID(pid);
 
 	q = td->td_proc;
 	if (pid == 0) {
Index: kern/vfs_extattr.c
===================================================================
--- kern/vfs_extattr.c	(revision 195102)
+++ kern/vfs_extattr.c	(working copy)
@@ -70,8 +70,8 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, fnvfslocked, error;
 
-	AUDIT_ARG(cmd, uap->cmd);
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_CMD(uap->cmd);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	/*
 	 * uap->attrname is not always defined.  We check again later when we
 	 * invoke the VFS call so as to pass in NULL there if needed.
@@ -82,7 +82,7 @@
 		if (error)
 			return (error);
 	}
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	vfslocked = fnvfslocked = 0;
 	mp = NULL;
@@ -223,12 +223,12 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	error = getvnode(td->td_proc->p_fd, uap->fd, &fp);
 	if (error)
@@ -258,11 +258,11 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
@@ -295,11 +295,11 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	NDINIT(&nd, LOOKUP, MPSAFE | NOFOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
@@ -403,12 +403,12 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	error = getvnode(td->td_proc->p_fd, uap->fd, &fp);
 	if (error)
@@ -438,11 +438,11 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
@@ -475,11 +475,11 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	NDINIT(&nd, LOOKUP, MPSAFE | NOFOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
@@ -553,12 +553,12 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return (error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	error = getvnode(td->td_proc->p_fd, uap->fd, &fp);
 	if (error)
@@ -585,11 +585,11 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return(error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
@@ -618,11 +618,11 @@
 	char attrname[EXTATTR_MAXNAMELEN];
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL);
 	if (error)
 		return(error);
-	AUDIT_ARG(text, attrname);
+	AUDIT_ARG_TEXT(attrname);
 
 	NDINIT(&nd, LOOKUP, MPSAFE | NOFOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
@@ -717,8 +717,8 @@
 	struct file *fp;
 	int vfslocked, error;
 
-	AUDIT_ARG(fd, uap->fd);
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_FD(uap->fd);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	error = getvnode(td->td_proc->p_fd, uap->fd, &fp);
 	if (error)
 		return (error);
@@ -745,7 +745,7 @@
 	struct nameidata nd;
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
 	error = namei(&nd);
@@ -775,7 +775,7 @@
 	struct nameidata nd;
 	int vfslocked, error;
 
-	AUDIT_ARG(value, uap->attrnamespace);
+	AUDIT_ARG_VALUE(uap->attrnamespace);
 	NDINIT(&nd, LOOKUP, MPSAFE | NOFOLLOW | AUDITVNODE1, UIO_USERSPACE,
 	    uap->path, td);
 	error = namei(&nd);
Index: kern/sys_generic.c
===================================================================
--- kern/sys_generic.c	(revision 195102)
+++ kern/sys_generic.c	(working copy)
@@ -561,13 +561,13 @@
 	struct file *fp;
 	int error;
 
-	AUDIT_ARG(fd, fd);
+	AUDIT_ARG_FD(fd);
 	if (length < 0)
 		return (EINVAL);
 	error = fget(td, fd, &fp);
 	if (error)
 		return (error);
-	AUDIT_ARG(file, td->td_proc, fp);
+	AUDIT_ARG_FILE(td->td_proc, fp);
 	if (!(fp->f_flag & FWRITE)) {
 		fdrop(fp, td);
 		return (EINVAL);
Index: kern/kern_prot.c
===================================================================
--- kern/kern_prot.c	(revision 195102)
+++ kern/kern_prot.c	(working copy)
@@ -489,7 +489,7 @@
 	int error;
 
 	uid = uap->uid;
-	AUDIT_ARG(uid, uid);
+	AUDIT_ARG_UID(uid);
 	newcred = crget();
 	uip = uifind(uid);
 	PROC_LOCK(p);
@@ -600,7 +600,7 @@
 	int error;
 
 	euid = uap->euid;
-	AUDIT_ARG(euid, euid);
+	AUDIT_ARG_EUID(euid);
 	newcred = crget();
 	euip = uifind(euid);
 	PROC_LOCK(p);
@@ -656,7 +656,7 @@
 	int error;
 
 	gid = uap->gid;
-	AUDIT_ARG(gid, gid);
+	AUDIT_ARG_GID(gid);
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = crcopysafe(p, newcred);
@@ -754,7 +754,7 @@
 	int error;
 
 	egid = uap->egid;
-	AUDIT_ARG(egid, egid);
+	AUDIT_ARG_EGID(egid);
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = crcopysafe(p, newcred);
@@ -819,7 +819,7 @@
 
 	if (ngrp > NGROUPS)
 		return (EINVAL);
-	AUDIT_ARG(groupset, groups, ngrp);
+	AUDIT_ARG_GROUPSET(groups, ngrp);
 	newcred = crget();
 	crextend(newcred, ngrp);
 	PROC_LOCK(p);
@@ -876,8 +876,8 @@
 
 	euid = uap->euid;
 	ruid = uap->ruid;
-	AUDIT_ARG(euid, euid);
-	AUDIT_ARG(ruid, ruid);
+	AUDIT_ARG_EUID(euid);
+	AUDIT_ARG_RUID(ruid);
 	newcred = crget();
 	euip = uifind(euid);
 	ruip = uifind(ruid);
@@ -942,8 +942,8 @@
 
 	egid = uap->egid;
 	rgid = uap->rgid;
-	AUDIT_ARG(egid, egid);
-	AUDIT_ARG(rgid, rgid);
+	AUDIT_ARG_EGID(egid);
+	AUDIT_ARG_RGID(rgid);
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = crcopysafe(p, newcred);
@@ -1009,9 +1009,9 @@
 	euid = uap->euid;
 	ruid = uap->ruid;
 	suid = uap->suid;
-	AUDIT_ARG(euid, euid);
-	AUDIT_ARG(ruid, ruid);
-	AUDIT_ARG(suid, suid);
+	AUDIT_ARG_EUID(euid);
+	AUDIT_ARG_RUID(ruid);
+	AUDIT_ARG_SUID(suid);
 	newcred = crget();
 	euip = uifind(euid);
 	ruip = uifind(ruid);
@@ -1087,9 +1087,9 @@
 	egid = uap->egid;
 	rgid = uap->rgid;
 	sgid = uap->sgid;
-	AUDIT_ARG(egid, egid);
-	AUDIT_ARG(rgid, rgid);
-	AUDIT_ARG(sgid, sgid);
+	AUDIT_ARG_EGID(egid);
+	AUDIT_ARG_RGID(rgid);
+	AUDIT_ARG_SGID(sgid);
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = crcopysafe(p, newcred);
Index: kern/kern_exec.c
===================================================================
--- kern/kern_exec.c	(revision 195102)
+++ kern/kern_exec.c	(working copy)
@@ -274,9 +274,9 @@
 	struct proc *p = td->td_proc;
 	int error;
 
-	AUDIT_ARG(argv, args->begin_argv, args->argc,
+	AUDIT_ARG_ARGV(args->begin_argv, args->argc,
 	    args->begin_envv - args->begin_argv);
-	AUDIT_ARG(envv, args->begin_envv, args->envc,
+	AUDIT_ARG_ENVV(args->begin_envv, args->envc,
 	    args->endp - args->begin_envv);
 	if (p->p_flag & P_HADTHREADS) {
 		PROC_LOCK(p);
@@ -413,13 +413,13 @@
 		binvp  = nd.ni_vp;
 		imgp->vp = binvp;
 	} else {
-		AUDIT_ARG(fd, args->fd);
+		AUDIT_ARG_FD(args->fd);
 		error = fgetvp(td, args->fd, &binvp);
 		if (error)
 			goto exec_fail;
 		vfslocked = VFS_LOCK_GIANT(binvp->v_mount);
 		vn_lock(binvp, LK_EXCLUSIVE | LK_RETRY);
-		AUDIT_ARG(vnode, binvp, ARG_VNODE1);
+		AUDIT_ARG_VNODE(binvp, ARG_VNODE1);
 		imgp->vp = binvp;
 	}
 
Index: kern/kern_descrip.c
===================================================================
--- kern/kern_descrip.c	(revision 195102)
+++ kern/kern_descrip.c	(working copy)
@@ -1144,7 +1144,7 @@
 	int fd;
 
 	fdp = td->td_proc->p_fd;
-	AUDIT_ARG(fd, uap->lowfd);
+	AUDIT_ARG_FD(uap->lowfd);
 
 	/*
 	 * Treat negative starting file descriptor values identical to
@@ -1219,12 +1219,12 @@
 	struct file *fp;
 	int error;
 
-	AUDIT_ARG(fd, fd);
+	AUDIT_ARG_FD(fd);
 
 	if ((error = fget(td, fd, &fp)) != 0)
 		return (error);
 
-	AUDIT_ARG(file, td->td_proc, fp);
+	AUDIT_ARG_FILE(td->td_proc, fp);
 
 	error = fo_stat(fp, sbp, td->td_ucred, td);
 	fdrop(fp, td);
Index: kern/kern_fork.c
===================================================================
--- kern/kern_fork.c	(revision 195102)
+++ kern/kern_fork.c	(working copy)
@@ -146,7 +146,7 @@
 	if ((uap->flags & RFKERNELONLY) != 0)
 		return (EINVAL);
 
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FFLAGS(uap->flags);
 	error = fork1(td, uap->flags, 0, &p2);
 	if (error == 0) {
 		td->td_retval[0] = p2 ? p2->p_pid : 0;
@@ -452,7 +452,7 @@
 	thread_lock(td);
 	sched_fork(td, td2);
 	thread_unlock(td);
-	AUDIT_ARG(pid, p2->p_pid);
+	AUDIT_ARG_PID(p2->p_pid);
 	LIST_INSERT_HEAD(&allproc, p2, p_list);
 	LIST_INSERT_HEAD(PIDHASH(p2->p_pid), p2, p_hash);
 
Index: kern/sys_process.c
===================================================================
--- kern/sys_process.c	(revision 195102)
+++ kern/sys_process.c	(working copy)
@@ -400,10 +400,10 @@
 	if (SV_CURPROC_FLAG(SV_ILP32))
 		wrap32 = 1;
 #endif
-	AUDIT_ARG(pid, uap->pid);
-	AUDIT_ARG(cmd, uap->req);
-	AUDIT_ARG(addr, uap->addr);
-	AUDIT_ARG(value, uap->data);
+	AUDIT_ARG_PID(uap->pid);
+	AUDIT_ARG_CMD(uap->req);
+	AUDIT_ARG_ADDR(uap->addr);
+	AUDIT_ARG_VALUE(uap->data);
 	addr = &r;
 	switch (uap->req) {
 	case PT_GETREGS:
@@ -549,7 +549,7 @@
 			pid = p->p_pid;
 		}
 	}
-	AUDIT_ARG(process, p);
+	AUDIT_ARG_PROCESS(p);
 
 	if ((p->p_flag & P_WEXIT) != 0) {
 		error = ESRCH;
Index: compat/freebsd32/freebsd32_misc.c
===================================================================
--- compat/freebsd32/freebsd32_misc.c	(revision 195102)
+++ compat/freebsd32/freebsd32_misc.c	(working copy)
@@ -2924,7 +2924,7 @@
 	struct uio *auio;
 	int error;
 
-	AUDIT_ARG(fflags, uap->flags);
+	AUDIT_ARG_FFLAGS(uap->flags);
 
 	/*
 	 * Filter out MNT_ROOTFS.  We do not want clients of nmount() in
Index: compat/linux/linux_signal.c
===================================================================
--- compat/linux/linux_signal.c	(revision 195102)
+++ compat/linux/linux_signal.c	(working copy)
@@ -546,8 +546,8 @@
 	ksiginfo_t ksi;
 	int error;
 
-	AUDIT_ARG(signum, signum);
-	AUDIT_ARG(pid, pid);
+	AUDIT_ARG_SIGNUM(signum);
+	AUDIT_ARG_PID(pid);
 
 	/*
 	 * Allow signal 0 as a means to check for privileges
@@ -563,7 +563,7 @@
 			return (ESRCH);
 	}
 
-	AUDIT_ARG(process, p);
+	AUDIT_ARG_PROCESS(p);
 	error = p_cansignal(td, p, signum);
 	if (error)
 		goto out;
Index: i386/i386/sys_machdep.c
===================================================================
--- i386/i386/sys_machdep.c	(revision 195102)
+++ i386/i386/sys_machdep.c	(working copy)
@@ -107,7 +107,7 @@
 	uint32_t base;
 	struct segment_descriptor sd, *sdp;
 
-	AUDIT_ARG(cmd, uap->op);
+	AUDIT_ARG_CMD(uap->op);
 	switch (uap->op) {
 	case I386_GET_IOPERM:
 	case I386_SET_IOPERM:
Index: security/audit/audit.h
===================================================================
--- security/audit/audit.h	(revision 195102)
+++ security/audit/audit.h	(working copy)
@@ -182,14 +182,151 @@
 void	 audit_thread_free(struct thread *td);
 
 /*
- * Define a macro to wrap the audit_arg_* calls by checking the global
+ * Define macros to wrap the audit_arg_* calls by checking the global
  * audit_enabled flag before performing the actual call.
  */
-#define	AUDIT_ARG(op, args...)	do {					\
-	if (td->td_pflags & TDP_AUDITREC)				\
-		audit_arg_ ## op (args);				\
+#define	AUDITING_TD(td)		((td)->td_pflags & TDP_AUDITREC)
+
+#define	AUDIT_ARG_ADDR(addr) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_addr((addr));					\
 } while (0)
 
+#define	AUDIT_ARG_ARGV(argv, argc, length) do {				\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_argv((argv), (argc), (length));		\
+} while (0)
+
+#define	AUDIT_ARG_AUDITON(udata) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_auditon((udata));				\
+} while (0)
+
+#define	AUDIT_ARG_CMD(cmd) do {						\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_cmd((cmd));					\
+} while (0)
+
+#define	AUDIT_ARG_DEV(dev) do {						\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_dev((dev));					\
+} while (0)
+
+#define	AUDIT_ARG_EGID(egid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_egid((egid));					\
+} while (0)
+
+#define	AUDIT_ARG_ENVV(envv, envc, length) do {				\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_envv((envv), (envc), (length));		\
+} while (0)
+
+#define	AUDIT_ARG_EXIT(status, retval) do {				\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_exit((status), (retval));			\
+} while (0)
+
+#define	AUDIT_ARG_EUID(euid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_euid((euid));					\
+} while (0)
+
+#define	AUDIT_ARG_FD(fd) do {						\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_fd((fd));					\
+} while (0)
+
+#define	AUDIT_ARG_FILE(p, fp) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_file((p), (fp));				\
+} while (0)
+
+#define	AUDIT_ARG_FFLAGS(fflags) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_fflags((fflags));				\
+} while (0)
+
+#define	AUDIT_ARG_GID(gid) do {						\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_gid((gid));					\
+} while (0)
+
+#define	AUDIT_ARG_GROUPSET(gidset, gidset_size) do {			\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_groupset((gidset), (gidset_size));		\
+} while (0)
+
+#define	AUDIT_ARG_MODE(mode) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_mode((mode));					\
+} while (0)
+
+#define	AUDIT_ARG_OWNER(uid, gid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_owner((uid), (gid));				\
+} while (0)
+
+#define	AUDIT_ARG_PID(pid) do {						\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_pid((pid));					\
+} while (0)
+
+#define	AUDIT_ARG_PROCESS(p) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_process((p));					\
+} while (0)
+
+#define	AUDIT_ARG_RGID(rgid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_gid((rgid));					\
+} while (0)
+
+#define	AUDIT_ARG_RUID(ruid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_ruid((ruid));					\
+} while (0)
+
+#define	AUDIT_ARG_SIGNUM(signum) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_signum((signum));				\
+} while (0)
+
+#define	AUDIT_ARG_SGID(sgid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_sgid((sgid));					\
+} while (0)
+
+#define	AUDIT_ARG_SUID(suid) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_suid((suid));					\
+} while (0)
+
+#define	AUDIT_ARG_TEXT(text) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_text((text));					\
+} while (0)
+
+#define	AUDIT_ARG_UID(uid) do {						\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_uid((uid));					\
+} while (0)
+
+#define	AUDIT_ARG_UPATH(td, upath, flags) do {				\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_upath((td), (upath), (flags));		\
+} while (0)
+
+#define	AUDIT_ARG_VALUE(value) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_value((value));				\
+} while (0)
+
+#define	AUDIT_ARG_VNODE(vp, flags) do {					\
+	if (AUDITING_TD(curthread))					\
+		audit_arg_vnode((vp), (flags));				\
+} while (0)
+
 #define	AUDIT_SYSCALL_ENTER(code, td)	do {				\
 	if (audit_enabled) {						\
 		audit_syscall_enter(code, td);				\
@@ -216,18 +353,40 @@
 
 #else /* !AUDIT */
 
-#define	AUDIT_ARG(op, args...)	do {					\
-} while (0)
+#define	AUDIT_ARG_ADDR(addr)
+#define	AUDIT_ARG_ARGV(argv, argc, length)
+#define	AUDIT_ARG_AUDITON(udata)
+#define	AUDIT_ARG_CMD(cmd)
+#define	AUDIT_ARG_DEV(dev)
+#define	AUDIT_ARG_EGID(egid)
+#define	AUDIT_ARG_ENVV(envv, envc, length)
+#define	AUDIT_ARG_EXIT(status, retval)
+#define	AUDIT_ARG_EUID(euid)
+#define	AUDIT_ARG_FD(fd)
+#define	AUDIT_ARG_FILE(p, fp)
+#define	AUDIT_ARG_FFLAGS(fflags)
+#define	AUDIT_ARG_GID(gid)
+#define	AUDIT_ARG_GROUPSET(gidset, gidset_size)
+#define	AUDIT_ARG_MODE(mode)
+#define	AUDIT_ARG_OWNER(uid, gid)
+#define	AUDIT_ARG_PID(pid)
+#define	AUDIT_ARG_PROCESS(p)
+#define	AUDIT_ARG_RGID(rgid)
+#define	AUDIT_ARG_RUID(ruid)
+#define	AUDIT_ARG_SIGNUM(signum)
+#define	AUDIT_ARG_SGID(sgid)
+#define	AUDIT_ARG_SUID(suid)
+#define	AUDIT_ARG_TEXT(text)
+#define	AUDIT_ARG_UID(uid)
+#define	AUDIT_ARG_UPATH(td, upath, flags)
+#define	AUDIT_ARG_VALUE(value)
+#define	AUDIT_ARG_VNODE(vp, flags)
 
-#define	AUDIT_SYSCALL_ENTER(code, td)	do {				\
-} while (0)
+#define	AUDIT_SYSCALL_ENTER(code, td)
+#define	AUDIT_SYSCALL_EXIT(error, td)
 
-#define	AUDIT_SYSCALL_EXIT(error, td)	do {				\
-} while (0)
+#define	AUDIT_SYSCLOSE(p, fd)
 
-#define	AUDIT_SYSCLOSE(p, fd)	do {					\
-} while (0)
-
 #endif /* AUDIT */
 
 #endif /* !_SECURITY_AUDIT_KERNEL_H_ */
Index: security/audit/audit_syscalls.c
===================================================================
--- security/audit/audit_syscalls.c	(revision 195102)
+++ security/audit/audit_syscalls.c	(working copy)
@@ -163,7 +163,7 @@
 
 	if (jailed(td->td_ucred))
 		return (ENOSYS);
-	AUDIT_ARG(cmd, uap->cmd);
+	AUDIT_ARG_CMD(uap->cmd);
 
 #ifdef MAC
 	error = mac_system_check_auditon(td->td_ucred, uap->cmd);
@@ -205,7 +205,7 @@
 		error = copyin(uap->data, (void *)&udata, uap->length);
 		if (error)
 			return (error);
-		AUDIT_ARG(auditon, &udata);
+		AUDIT_ARG_AUDITON(&udata);
 		break;
 	}
 
Index: amd64/amd64/sys_machdep.c
===================================================================
--- amd64/amd64/sys_machdep.c	(revision 195102)
+++ amd64/amd64/sys_machdep.c	(working copy)
@@ -87,7 +87,7 @@
 	 * XXXKIB check that the BSM generation code knows to encode
 	 * the op argument.
 	 */
-	AUDIT_ARG(cmd, uap->op);
+	AUDIT_ARG_CMD(uap->op);
 	if (uap_space == UIO_USERSPACE) {
 		error = copyin(uap->parms, &la, sizeof(struct i386_ldt_args));
 		if (error != 0)
